GDPR privacy notice: Applicants to a new role

Transcription

1 GDPR privacy notice: Applicants to a new role All schools are required to detail to prospective staff how their personal data may be collected and used. This Privacy Notice ensures compliance with the EU General Data Protection Regulations (2018) and communicates how we process personal data when recruiting new members of staff. Who processes your information? As part of the Alder Bridge School s recruitment process, certain information needs to be collected so your application can be considered. The following privacy notice informs you how the school intends to collect, use, process and store your data. 1 Alder Bridge School is the data controller for the purposes of Data Protection legislation, and we are responsible for any personal data that is provided to the school. This means that we determine the purposes for, and the manner in which, any personal data relating to any prospective staff member is to be processed. Lynn MacLauchlan is the data protection contact (as an Independent School/Charity we are not legally bound to appoint a Data Protection Officer unlike Public Bodies and larger organisations). Their role is to oversee and monitor the school s data processing practices. Should you have any queries pertaining to how the school processes data, she can be contacted on or lynn.maclauchlan@alderbridge.org.uk Where necessary, third parties may be responsible for processing personal information (for example, in relation to DBS forms or pension information). Where this is required, Alder Bridge School places data protection requirements on third party processors in line with our own data protection requirements, to ensure data is processed in line with prospective staff members privacy rights. Why do we need your information? Alder Bridge School has the legal right and a legitimate interest to collect and process personal data relating to its prospective employees to ensure the school s safeguarding and safer recruitment protocols are upheld. We process personal data to meet the requirements set out in UK employment and childcare law, including those in relation to the following: Safeguarding Vulnerable Groups Act 2006 The Childcare (Disqualification) Regulations 2009 Keeping Children Safe in Education 2016 Working Together to Safeguard Children 2015 Individuals who are recruited will have their personal data processed to assist in the running of the school, and to enable individuals to be paid. 1 General Data Protection Regulations (GDPR) which supersedes the Data Protection Act (1998) from

2 If prospective members of staff fail to provide their personal data, there may be significant consequences. These include the following: Conditional offer of appointment retracted due to insufficient personal data provided in order to make safe recruitment checks; Failure to provide the school with ample proof of a right to work in the UK will prevent employment at Alder Bridge School; Employees found to be working illegally could face prosecution by law enforcement officers; Failure to provide accurate tax codes and/or national insurance numbers could lead to issues of delayed payments or an employee paying too much tax. 2 Failure to disclose special category sensitive data concerning fitness to work may result in a withdrawal of offer of appointment. Alder Bridge School is aware of its duties under the Equality Act No job offer will be withdrawn without first consulting with the applicant, obtaining medical evidence and considering reasonable adjustments. Knowingly withholding or failure to disclose criminal records data concerning current police investigations or receiving any conviction or caution; or any occurrence that may disqualify you from providing childcare under the Childcare (Disqualification) Regulations 2009 may result in a withdrawal of offer of appointment. Where appointed, this may result in disciplinary action up to, and including dismissal. For which purposes are your personal data processed? In accordance with the above, personal data pertaining to prospective members of staff is used for the following reasons: Safe recruitment and general Employment checks, e.g. right to work in the UK; General recruitment practice; Contractual requirements; Salary and taxation purposes; Emergency contact details; Medical reasons (e.g. for any reasonable adjustments required or for an Individual Health Plan to be drafted); Pension requirements; Simply Health registration; Compliance with employment law and the Equality Act Which data is collected? The personal data the school will collect from the prospective members of staff includes the following: Name; Address; Phone number; Address; Work history for example, previous employers and positions; Education and work history including professional qualifications and skills; References (including HR access to Disciplinary proceedings due to safe recruitment); Nationality, visa, proof of right to work permit information including passport, driving licence and National Insurance number; 2 Special categories of data is the type of data which reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership; genetic data, biometric data or data concerning health or sex life and sexual orientation.

3 Results of Pre-employment screening checks (for example, criminal records checks where permitted under legislation); Characteristics such as ethnic group; Remuneration details; Qualifications; Absence information; Medical information (where conditional offer of appointment has been made) and name/address of Doctor; Bank/Building Society details (for payroll purposes) Car details (for staff parking purposes). Photographs and images where consent has been given. The collection of personal information will benefit the DfE, SIS, and LA: Enabling the development of a comprehensive picture of the workforce and how it is deployed; Informing the development of recruitment and retention policies; Enabling ethnicity and disability monitoring; Supporting the work of the Steiner Waldorf Fellowship; Linking with Social Service, law enforcement organisations and courts where appropriate; It also assists HMRC, ensuring correct salary and payroll information for tax purposes. Will your personal data be sought from third parties? Personal data is only sought from the data subject. No third parties will be contacted to obtain personal data pertaining to prospective members of staff without the data subject s consent. Prospective staff members personal data may be obtained and processed from third parties where the law requires the school to do so, e.g. DBS checks. The categories of data obtained and processed from third parties include: Personal data relating to identification of individual; Sensitive personal data relating to health; Criminal Records data relating to the Disclosure and Barring Service checks, Prohibition Orders, EEA Member sanctions, Section 128 direction checks and criminal records checks abroad where necessary; Where data is obtained from third parties, the personal data originates from the following sources: Disclosure and Barring Service; Appropriate Foreign Embassy (where applicable); DfE Teacher Services System; Referees; Current or previous employers; Awarding Bodies; Education establishments; HMRC; Medical practitioner (where applicable); Local Authority (e.g. Social Services); Police (where applicable).

4 How is your information shared? Alder Bridge School takes data protection very seriously and we will not share your personal information with any third parties without your consent, unless the law dictates us to do so. How long is your data retained for? Personal data is retained in line with Alder Bridge Schools GDPR Records Management Policy. Personal information may be retained for varying periods of time depending on the nature of the information; you may request how long your data will be obtained by the school. Data will only be retained for as long as is necessary to fulfil the purposes for which it was processed, and will not be retained indefinitely if there is no such reason for it to be. Once your data has served its purpose it will be disposed of in line with the procedure outlined in the school s GDPR Records Management Policy. If you require further information regarding retention of data, and the periods for which your personal data is held for, please contact our Data Protection contact for a copy. What are your rights? As the data subject, you have specific rights to the processing of your data. You have a legal right to: Request access to the personal data that Alder Bridge School holds. 3 Request that your personal data is amended (where statutory legislation allows). Request that your personal data is erased (where statutory legislation allows);. Request that the processing of your data is restricted (where statutory legislation allows); Request to obtain and reuse your personal data for your own purposes across different services; Object to your data being processed; Request that your personal data is collected using automated processing. Where the processing of your data is based on your explicit consent, you have the right to withdraw this consent at any time. This will not affect any personal data that has been processed prior to withdrawing consent. You can withdraw consent by completing a Consent Withdrawal Form (which outlines what personal data you wish to be erased) and ing it to personnel@alderbridge.org.uk. You also have the right to lodge a complaint with the ICO in relation to how Alder Bridge processes your personal data. If you wish to make a complaint to the ICO, you can do so on the ICO s website or call their helpline on How can you find out more information? If you require further information about how we store and use your personal data, please visit our website, the Gov.UK website, or download our GDPR Data Protection Policy and Records Management Policy. 3 Alder Bridge School has a responsibility for retaining and maintaining records in line with statutory requirements. For further information, please refer to the Schools GDPR-Compliant Record Management Policy.

5 Privacy Notice: Applicants to a New Role Declaration I,... declare that I understand: Alder Bridge School has a legal and legitimate interest to collect and process my personal data in order to meet statutory and contractual requirements. There may be significant consequences if I fail to provide the personal data the school requires. If I am successful in my application then I understand that I will receive a separate workforce privacy notice from the school. Alder Bridge School will not share my data with any other third parties without my consent, unless the law requires the school to do so. The nature and personal categories of this data, and where the personal data originates from and where my data is obtained from third parties. My data is retained in line with the school s GDPR-Compliant Records Management Policy. My rights to the processing of my personal data. Name of prospective staff member: Signature of prospective staff member: Date: